General

  • Target

    sbi-offer.apk

  • Size

    8.0MB

  • MD5

    f608080c23595b75fa0c8e334136a72c

  • SHA1

    23e82e75329ef05eb65fb40bf20dea610c1338b3

  • SHA256

    3a99519be856349ccb1c4aeccdea448af605429b77ee513bb0469d30c0968b83

  • SHA512

    60cef30d4df60f80a851747a338b169a066bfb40370091025e4f8f5f89f4583dc0fee08145d2c11e8b7dc014e52b90507a70fd48991042a00f37978523d2c6c5

  • SSDEEP

    196608:7ozmplvEBoMvOcHW/hspOb+sl0ZNeubus9ZDoK5Jsl3tnNGEk:7vvEO6OBsYb+DZNeubus9ZD9Ja3tNGL

Score
10/10

Malware Config

Extracted

Family

axbanker

C2

https://allcardservice.com/api/user/step1

Signatures

  • Axbanker family
  • Requests dangerous framework permissions 4 IoCs

Files

  • sbi-offer.apk
    .apk android arch:arm

    com.supercell.clashofclans

    com.supercell.clashofclans.SplashActivity


Android Permissions

sbi-offer.apk

Permissions

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.INSTANT_APP_FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE

android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

com.supercell.clashofclans.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION